Monday, 6 February 2012

KLM wants you to make the DHS your friend on Facebook

Getting the jump on airline "social seating" startups like SeatID.com, KLM launched a new Meet & Seat service last Friday that allows passengers on certain flights (including some to and from the USA) to make portions fo their Facebook and /or LinkedIn profiles available for viewing by fellow passengers -- who, presumably, might want to use that profile data to determine whether to sit (or avoid sitting) near a friend, enemy, target of identity theft, someone on whom they want to eavesdrop, someone they are stalking, or someone matching other criteria.

There's no mention in the terms and conditions for the "Meet & Seat" service of what data is actually imported into KLM's systems, or where it is stored.

I asked KLM's New York-based publicists about this on Friday when they sent me the launch announcement. They first referred me to this webpage (which doesn't mention privacy or data protection or answer our questions), then bounced my query to the p.r. department at their corporate headquarters in Amsterdam. They didn't respond to my e-mail messages or answer their phone by the close of business in Amsterdam or New York today.

Specifically, I asked KLM:

Does a passenger provide their password to KLM to retrieve info from their Facebook or LinkedIn profile, or authorize KLM to do so as a Facebook app? What's actually stored by KLM (Facebook user ID? password? authorization code for the app? data retrieved from Facebook), and where (e.g. in the PNR or departure control system)?

PNRs for all KLM flights -- not just those to or from the USA -- can be retrieved by offices in the USA of KLM, its codeshare partners, and the computerized reservation systems that host those PNRs.

US laws would allow the DHS, FBI, and/or other Federal agencies to require those US offices to retrieve this data, hand it over to the US government, and keep the fact that they had done so secret. KLM has previously claimed, in response to requests for records of whether this has happened, that netiher KLm nor its primary PNR hosting provider Amadeus keep any logs of access to this data, and that it has no agreements with its agents and codeshare partners requiring them to keep such records or to provide them KLM.

If KLM is storing Facebook or LinkedIn data in its departure control system, it won't automatically be pushed to the DHS, but it will still be retrievable by the US offices of KLM, its codeshare partners, and its ground handling agents -- and hence by the DHS and FBI.

It's theoretically possible that none of this data is stored in PNRs or the DCS, but only in a separate database not accessible from the US. Unlikely, I suspect, but possible. If so, KLM should say so, and make that an explicit contractual commitment.

Otherwise, anyone who uses "Meet & Seat" may find that whatever information you "share" with fellow passengers is also shared with the DHS, and your ATS file is permanently linked to your Facebook ID even if you later opt out of the KLM social seating service.

If anyone uses KLM's "Meet & Seat" and subsequently requests their records from KLM under Dutch data protection law, please let me know (in the comments or privately) what you find out. I'll be happy to help you try to decipher any response from KLM or its agents or contractors.

[Update: Three days after I published this story, KLM responded to my questions that KLM's "Meet & Seat" is "authorised as a Facebook or LinkedIn app.... No passwords are stored [in the PNR or the Departure Control System], but the basic data that is imported from the Facebook or LinkedIn profile (name, picture, school, company etc.) will be stored by KLM in a separate, secure database. If the passenger wants to update these details, he has to provide his LinkedIn or Facebook details again. The profile details will be deleted automatically 2 days after the last flight in your reservation has been flown. Nothing is stored in the PNR or DCS." I'm seeking further clarification as to where this "separate, secure" database is stored, to whom and from where it is accessible, and what privacy and data protection rules and policies it is subject to. And I remain interested in hearing from anyone who has obtained a copy of their KLM "Meet & Seat" records in response to a request under Dutch or other data protection law.]

[Further update from KLM: "Part of our security is not to tell everybody where we store private information." That appears to violate EU and Dutch data protection rules requiring disclosure of (1) by whom personal data is processed and (2) to what other countries it is transferred. I've asked KLM about this, but haven't heard back yet.]

"Congress shall make no law ... abridging ... the right of the people peaceably to assemble." (U.S. Constitution)

"Everyone has the right to freedom of movement and residence within the borders of each state. Everyone has the right to leave any country, including his own, and to return to his country." (Universal Declaration of Human Rights)

"Liberty of movement is an indispensable condition for the free development of a person." (United Nations Human Rights Committee)